Maemo security

At the Maemo Summit 2009, Nokia shared a great deal of information about the security mechanisms that would be available and/or mandated in upcoming platforms.

The concepts outlined include well established favourites in the OSS world (like privilege management) as well as some that are rather less well regarded - such as relatives of the Trusted Computing Platform and DRM.

Inevitably there will be a significant amount of interest and concern about how this affects the open nature of the Maemo platform.

This page is intended to capture community questions (and, eventually I hope, Nokia's answers) about these issues.

Initially please add questions to the discussion page and once they've been refined and consolidated, we'll add them onto this page.

Some examples:

Contents

[edit] Is there a diagram showing the security framework and components?

See slide #2, #5 and #9 of Elena Reshetova's Maemo Summit presentation

Elena Reshetova: The presentation was uploaded, and currently it is the only information, which I can share.

[edit] What is "Open Mode" and can it be revoked remotely?

"Open" mode is when an unsigned kernel has been booted. Disabling it remotely would, presumably, require a change to the bootloader. See slide #??? --Jaffa 11:36, 13 October 2009 (UTC)

[edit] What does closed mode restrict you from doing?

  • Terminal?
  • Root?

Elena Reshetova: In general "close" mode has its own security policy, which user won't be able to change.

  • Cellular is marked as a protected ressource in the slide. Can one still use it (phone, data, sms etc.) while running in open mode? While running a rebuilt kernel?

Elena Reshetova: If you use your own kernel, you are the one to set the security policy for the device, meaning that your SW in this case can make calls, send SMS and so on (for example). Please note that the list of protected resources on the slide is given just as example (to show the possible granularity level), so it doesn't mean that we would have exactly these resources.

[edit] How easy is it to switch between Open and Closed modes?

Is it so trivial that you would want to and be able to do it several times a day and on the go (without restart)?

Elena Reshetova: I should be able to tell the exact procedure in the future, but for now I can say that it won't be so trivial (like press the GUI button :-)), and the restart is needed. The checks for the SW image are done by the Loader, and during the boot time, so you do need to restart.

[edit] Can network operators restrict you switching to Open mode?

Like if a device is SIM-locked to a particular network, does the device get locked down in closed DRM mode only too? Can you always switch to open mode?

Elena Reshetova: If the device is SIM-locked, operator can restrict you to the usage of one particular kernel (slide 5), for example the one, which was shipped with a device. However, it is up to you to decide to buy the device from the operator or from the Nokia store.

Till Harbaum: Imho GPLv3 requires you to provide "installation instructions". gstreamer comes under GPLv3, MeeGo uses gstreamer, hence no distributor is allowed to prevent the installation of e.g. a modified version of gstreamer. They are even required to tell you how to do that.

[edit] How granular is the encryption?

If my app creates content in the closed mode can I see it in open mode?

Elena Reshetova: If your application uses the Protected Storage for encryption (slide 8) in the initial mode, and after you switch to another mode, the application won't be able to get decrypted data. If your application just stores the data in the filesystem, after switching to your own kernel, you will be able to access the data (because they are just plain files in the filesystem).

[edit] Can open applications use the privilege mechanisms in the Open and Closed modes?

Elena Reshetova: I guess the question is "Can the applications access protected resources in both modes?" I hope I got the question correctly. The answer is that the Device Security Policy (slide 7) defines the resources can be potentially granted to the SW coming from a particular SW source. When one uses the Nokia signed kernel, the device security policy is defined, and user can't change it. If one uses its own kernel (or community kernel for example), he (or community) is the one to define/change the device policy. This means that one can, for example, change the policy in the way that the SW coming from the maemo.org gets access to all protected resources (of course some content becomes unavailable when one switch to its own kernel, for example DRM). However, again, it is possible only while using your own kernel.

[edit] Can open applications use the DRM encryption mechanisms in the Open and Closed modes?

[edit] Will community extensions to the kernel (modules) be permitted in Open/Closed modes?

I can't see how - which leads to the question: How do community 'enhancements' to the kernel get adopted?

Elena Reshetova: In the "Open" mode any changes of the kernel are allowed. Regarding the "closed" mode, unfortunately I am not the right person to answer this question.

[edit] Is there any GPLv3 software impacted?

Retrieved from "http://bugs.maemo.org/Maemo_security"